CSR Decoder

What the decoder shows

A CSR is an ASN.1 structure (PKCS #10). The decoder reads two things from it:

• Subject: the Distinguished Name fields that were requested, typically the country (C), organisation (O), organisational unit (OU), locality (L), state (ST) and common name (CN).
• Public key: the algorithm (RSA, EC, DSA) and the key size in bits.

The signature inside the CSR is what proves to the CA that the submitter holds the matching private key. This decoder does not display it; the CA verifies it when the request is processed.

Example output

For a typical domain certificate request, the output looks like this:

Subject: commonName=www.example.com, organizationName=Example Inc., countryName=US
Key bits: 2048
Key type: RSA

The exact attribute names in the subject depend on how the request was generated.

Fields to double-check

• Common Name (CN): should be the primary hostname. Modern browsers ignore CN and look only at SANs, but many CAs still require a valid CN.
• Country (C): 2-letter ISO code (US, GB, DE), not a full name. CAs reject wrong codes.
• Key size: RSA 2048 is the floor; 3072 or 4096 for higher security. ECDSA P-256 is a good modern alternative and produces a smaller cert.

About Subject Alternative Names (SANs)

The decoder shows the subject of the request but not the SAN extension. Browsers match certificates against SANs rather than the CN, so if the certificate needs extra hostnames, include them when the request is generated, for example:

openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

When the decoder cannot parse the CSR

The most common causes are a truncated or broken PEM block:

• Truncated text: re-paste the complete block including both markers.
• Inserted line breaks: paste the block exactly as it was generated.
• Wrong content: a public key, certificate or private key pasted by mistake will not parse as a CSR.

Generating a certificate request

A CSR is always generated alongside a private key. Typical command:

openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr

Or for ECDSA:

openssl req -new -newkey ec:<(openssl ecparam -name prime256v1) -nodes -keyout example.key -out example.csr

Guard the private key; if it leaks, the certificate must be revoked.